hxxps://lp[.]constantcontactpages[.]com/cu/dmXOzj7

Resubmissions

13/11/2023, 15:38 UTC

231113-s25jlsdh65 1

13/11/2023, 15:35 UTC

231113-s1ea2adh56 1

13/11/2023, 14:35 UTC

231113-ryaz6adb5s 1

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
13/11/2023, 15:38 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://lp.constantcontactpages.com/cu/dmXOzj7

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133443635086480284"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4892	chrome.exe
4892	chrome.exe
3956	chrome.exe
3956	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4892	chrome.exe
4892	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 4676	4892	chrome.exe	54
PID 4892 wrote to memory of 4676	4892	chrome.exe	54
PID 4892 wrote to memory of 2676	4892	chrome.exe	89
PID 4892 wrote to memory of 2676	4892	chrome.exe	89
PID 4892 wrote to memory of 2676	4892	chrome.exe	89
PID 4892 wrote to memory of 2676	4892	chrome.exe	89
PID 4892 wrote to memory of 2676	4892	chrome.exe	89
PID 4892 wrote to memory of 2676	4892	chrome.exe	89
PID 4892 wrote to memory of 2676	4892	chrome.exe	89
PID 4892 wrote to memory of 2676	4892	chrome.exe	89
PID 4892 wrote to memory of 2676	4892	chrome.exe	89
PID 4892 wrote to memory of 2676	4892	chrome.exe	89
PID 4892 wrote to memory of 2676	4892	chrome.exe	89
PID 4892 wrote to memory of 2676	4892	chrome.exe	89
PID 4892 wrote to memory of 2676	4892	chrome.exe	89
PID 4892 wrote to memory of 2676	4892	chrome.exe	89
PID 4892 wrote to memory of 2676	4892	chrome.exe	89
PID 4892 wrote to memory of 2676	4892	chrome.exe	89
PID 4892 wrote to memory of 2676	4892	chrome.exe	89
PID 4892 wrote to memory of 2676	4892	chrome.exe	89
PID 4892 wrote to memory of 2676	4892	chrome.exe	89
PID 4892 wrote to memory of 2676	4892	chrome.exe	89
PID 4892 wrote to memory of 2676	4892	chrome.exe	89
PID 4892 wrote to memory of 2676	4892	chrome.exe	89
PID 4892 wrote to memory of 2676	4892	chrome.exe	89
PID 4892 wrote to memory of 2676	4892	chrome.exe	89
PID 4892 wrote to memory of 2676	4892	chrome.exe	89
PID 4892 wrote to memory of 2676	4892	chrome.exe	89
PID 4892 wrote to memory of 2676	4892	chrome.exe	89
PID 4892 wrote to memory of 2676	4892	chrome.exe	89
PID 4892 wrote to memory of 2676	4892	chrome.exe	89
PID 4892 wrote to memory of 2676	4892	chrome.exe	89
PID 4892 wrote to memory of 2676	4892	chrome.exe	89
PID 4892 wrote to memory of 2676	4892	chrome.exe	89
PID 4892 wrote to memory of 2676	4892	chrome.exe	89
PID 4892 wrote to memory of 2676	4892	chrome.exe	89
PID 4892 wrote to memory of 2676	4892	chrome.exe	89
PID 4892 wrote to memory of 2676	4892	chrome.exe	89
PID 4892 wrote to memory of 2676	4892	chrome.exe	89
PID 4892 wrote to memory of 2676	4892	chrome.exe	89
PID 4892 wrote to memory of 1092	4892	chrome.exe	91
PID 4892 wrote to memory of 1092	4892	chrome.exe	91
PID 4892 wrote to memory of 1620	4892	chrome.exe	90
PID 4892 wrote to memory of 1620	4892	chrome.exe	90
PID 4892 wrote to memory of 1620	4892	chrome.exe	90
PID 4892 wrote to memory of 1620	4892	chrome.exe	90
PID 4892 wrote to memory of 1620	4892	chrome.exe	90
PID 4892 wrote to memory of 1620	4892	chrome.exe	90
PID 4892 wrote to memory of 1620	4892	chrome.exe	90
PID 4892 wrote to memory of 1620	4892	chrome.exe	90
PID 4892 wrote to memory of 1620	4892	chrome.exe	90
PID 4892 wrote to memory of 1620	4892	chrome.exe	90
PID 4892 wrote to memory of 1620	4892	chrome.exe	90
PID 4892 wrote to memory of 1620	4892	chrome.exe	90
PID 4892 wrote to memory of 1620	4892	chrome.exe	90
PID 4892 wrote to memory of 1620	4892	chrome.exe	90
PID 4892 wrote to memory of 1620	4892	chrome.exe	90
PID 4892 wrote to memory of 1620	4892	chrome.exe	90
PID 4892 wrote to memory of 1620	4892	chrome.exe	90
PID 4892 wrote to memory of 1620	4892	chrome.exe	90
PID 4892 wrote to memory of 1620	4892	chrome.exe	90
PID 4892 wrote to memory of 1620	4892	chrome.exe	90
PID 4892 wrote to memory of 1620	4892	chrome.exe	90
PID 4892 wrote to memory of 1620	4892	chrome.exe	90

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://lp.constantcontactpages.com/cu/dmXOzj7
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffdd379758,0x7fffdd379768,0x7fffdd379778
  2⤵
  PID:4676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 --field-trial-handle=1864,i,15097754202413105656,5837137012716402607,131072 /prefetch:2
  2⤵
  PID:2676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2180 --field-trial-handle=1864,i,15097754202413105656,5837137012716402607,131072 /prefetch:8
  2⤵
  PID:1620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1864,i,15097754202413105656,5837137012716402607,131072 /prefetch:8
  2⤵
  PID:1092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2976 --field-trial-handle=1864,i,15097754202413105656,5837137012716402607,131072 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2968 --field-trial-handle=1864,i,15097754202413105656,5837137012716402607,131072 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4888 --field-trial-handle=1864,i,15097754202413105656,5837137012716402607,131072 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 --field-trial-handle=1864,i,15097754202413105656,5837137012716402607,131072 /prefetch:8
  2⤵
  PID:3064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 --field-trial-handle=1864,i,15097754202413105656,5837137012716402607,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3956

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:692

Network

DNS

lp.constantcontactpages.com

chrome.exe

Remote address:

8.8.8.8:53

Request

lp.constantcontactpages.com

IN A

Response

lp.constantcontactpages.com

IN CNAME

lp.constantcontactpages.com.cdn.cloudflare.net

lp.constantcontactpages.com.cdn.cloudflare.net

IN A

172.64.149.60

lp.constantcontactpages.com.cdn.cloudflare.net

IN A

104.18.38.196
DNS

73.159.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

73.159.190.20.in-addr.arpa

IN PTR

Response
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response
DNS

158.240.127.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

158.240.127.40.in-addr.arpa

IN PTR

Response
DNS

234.168.217.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

234.168.217.172.in-addr.arpa

IN PTR

Response

234.168.217.172.in-addr.arpa

IN PTR

ams15s40-in-f101e100net
DNS

9.228.82.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

9.228.82.20.in-addr.arpa

IN PTR

Response
DNS

60.149.64.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

60.149.64.172.in-addr.arpa

IN PTR

Response
DNS

static.ctctcdn.com

chrome.exe

Remote address:

8.8.8.8:53

Request

static.ctctcdn.com

IN A

Response

static.ctctcdn.com

IN CNAME

static.ctctcdn.com.cdn.cloudflare.net

static.ctctcdn.com.cdn.cloudflare.net

IN A

172.64.147.103

static.ctctcdn.com.cdn.cloudflare.net

IN A

104.18.40.153
GET

https://static.ctctcdn.com/ui/images1/landing_page_block_icon_error_crop.svg

chrome.exe

Remote address:

172.64.147.103:443

Request

GET /ui/images1/landing_page_block_icon_error_crop.svg HTTP/2.0
host: static.ctctcdn.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://lp.constantcontactpages.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Mon, 13 Nov 2023 15:38:27 GMT
content-type: image/svg+xml
content-length: 2688
last-modified: Wed, 17 Apr 2019 17:19:00 GMT
expires: Fri, 08 Nov 2024 16:01:26 GMT
vary: Accept-Encoding,User-Agent
content-encoding: gzip
access-control-allow-origin: *
cache-control: max-age=31536000, public
cf-cache-status: HIT
age: 344221
accept-ranges: bytes
x-robots-tag: noindex
server: cloudflare
cf-ray: 82581a147ea30a58-AMS
GET

https://static.ctctcdn.com/ui/images1/favicon/favicon.png?rb=2

chrome.exe

Remote address:

172.64.147.103:443

Request

GET /ui/images1/favicon/favicon.png?rb=2 HTTP/2.0
host: static.ctctcdn.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://lp.constantcontactpages.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Mon, 13 Nov 2023 15:38:28 GMT
content-type: image/webp
content-length: 2048
access-control-allow-origin: *
cache-control: max-age=31536000, public
cf-bgj: imgq:100,h2pri
cf-polished: origFmt=png, origSize=4043
content-disposition: inline; filename="favicon.webp"
expires: Wed, 06 Nov 2024 21:36:07 GMT
last-modified: Mon, 10 Aug 2020 17:40:23 GMT
vary: Accept
cf-cache-status: HIT
age: 496941
accept-ranges: bytes
x-robots-tag: noindex
server: cloudflare
cf-ray: 82581a158fce0a58-AMS
DNS

js-agent.newrelic.com

chrome.exe

Remote address:

8.8.8.8:53

Request

js-agent.newrelic.com

IN A

Response

js-agent.newrelic.com

IN CNAME

k.sni.global.fastly.net

k.sni.global.fastly.net

IN A

151.101.2.137

k.sni.global.fastly.net

IN A

151.101.66.137

k.sni.global.fastly.net

IN A

151.101.130.137

k.sni.global.fastly.net

IN A

151.101.194.137
GET

https://js-agent.newrelic.com/nr-spa-1.246.1.min.js

chrome.exe

Remote address:

151.101.2.137:443

Request

GET /nr-spa-1.246.1.min.js HTTP/2.0
host: js-agent.newrelic.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://lp.constantcontactpages.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

x-amz-id-2: Vdh8dnSbVkTzpoSZSh5CcX+d0bmXc8/sZmUEPEemx4BeBJf03BRu9xxLvB2z0jpcQlKtAwhYYQU=
x-amz-request-id: WEXKH3Q0ZE7M72KS
last-modified: Tue, 31 Oct 2023 15:33:55 GMT
etag: "fe135b6e7222948159657c8cf35dedab"
x-amz-server-side-encryption: AES256
cache-control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400
x-amz-version-id: YYfIXhQaf2yM3tlTfH7xiASp7e7IUG9W
content-type: application/javascript
server: AmazonS3
access-control-allow-origin: *
content-encoding: br
accept-ranges: bytes
date: Mon, 13 Nov 2023 15:38:28 GMT
via: 1.1 varnish
x-served-by: cache-ams21071-AMS
x-cache: HIT
x-cache-hits: 473041
x-timer: S1699889909.514560,VS0,VE0
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=300
content-length: 28993
DNS

103.147.64.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

103.147.64.172.in-addr.arpa

IN PTR

Response
DNS

bam.nr-data.net

chrome.exe

Remote address:

8.8.8.8:53

Request

bam.nr-data.net

IN A

Response

bam.nr-data.net

IN CNAME

bam.cell.nr-data.net

bam.cell.nr-data.net

IN CNAME

fastly-tls12-bam.nr-data.net

fastly-tls12-bam.nr-data.net

IN A

162.247.243.29
DNS

137.2.101.151.in-addr.arpa

Remote address:

8.8.8.8:53

Request

137.2.101.151.in-addr.arpa

IN PTR

Response
DNS

226.21.18.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

226.21.18.104.in-addr.arpa

IN PTR

Response
POST

https://bam.nr-data.net/1/5ab79a9e36?a=5888164&v=1.246.1&to=Y1MHYRBUCBJZBRJfW1oZNkUQXAgGewkIQkZbWglQEBoFFBcdE0RYfVIAWxZcAAhdFBsWHHNzMRw%3D&rst=1555&ck=0&s=584eed1b9b3ace99&ref=https://lp.constantcontactpages.com/cu/dmXOzj7&af=err,xhr,stn,ins,spa&ap=128&be=654&fe=333&dc=118&at=TxQQF1hORCJZCxZXXVNYLFFAD0RQAVMABANVBUgMVgZfTAxXVgQZDARVAk8DVgBbUQUGVlJSUwJAGUQgWxIPQF1ATyxRQA9EUwtTAAJWUlNIVgcNBEwMXgVXGQ1VUA1PV1JTWV5SD1EMDwFUQBlEMlESA3lDWlMXfAYXXFAJUlYOBQUOXQVTAlAcRQ%3D%3D&fsh=1&perf=%7B%22timing%22:%7B%22of%22:1699889905789,%22n%22:0,%22f%22:38,%22dn%22:226,%22dne%22:299,%22c%22:299,%22s%22:332,%22ce%22:392,%22rq%22:393,%22rp%22:654,%22rpe%22:735,%22di%22:772,%22ds%22:772,%22de%22:772,%22dc%22:946,%22l%22:946,%22le%22:987%7D,%22navigation%22:%7B%7D%7D&fp=771&fcp=771

chrome.exe

Remote address:

162.247.243.29:443

Request

POST /1/5ab79a9e36?a=5888164&v=1.246.1&to=Y1MHYRBUCBJZBRJfW1oZNkUQXAgGewkIQkZbWglQEBoFFBcdE0RYfVIAWxZcAAhdFBsWHHNzMRw%3D&rst=1555&ck=0&s=584eed1b9b3ace99&ref=https://lp.constantcontactpages.com/cu/dmXOzj7&af=err,xhr,stn,ins,spa&ap=128&be=654&fe=333&dc=118&at=TxQQF1hORCJZCxZXXVNYLFFAD0RQAVMABANVBUgMVgZfTAxXVgQZDARVAk8DVgBbUQUGVlJSUwJAGUQgWxIPQF1ATyxRQA9EUwtTAAJWUlNIVgcNBEwMXgVXGQ1VUA1PV1JTWV5SD1EMDwFUQBlEMlESA3lDWlMXfAYXXFAJUlYOBQUOXQVTAlAcRQ%3D%3D&fsh=1&perf=%7B%22timing%22:%7B%22of%22:1699889905789,%22n%22:0,%22f%22:38,%22dn%22:226,%22dne%22:299,%22c%22:299,%22s%22:332,%22ce%22:392,%22rq%22:393,%22rp%22:654,%22rpe%22:735,%22di%22:772,%22ds%22:772,%22de%22:772,%22dc%22:946,%22l%22:946,%22le%22:987%7D,%22navigation%22:%7B%7D%7D&fp=771&fcp=771 HTTP/1.1
Host: bam.nr-data.net
Connection: keep-alive
Content-Length: 0
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-platform: "Windows"
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
content-type: text/plain
Accept: */*
Origin: https://lp.constantcontactpages.com
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://lp.constantcontactpages.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Connection: keep-alive
Content-Length: 40
date: Mon, 13 Nov 2023 15:38:28 GMT
content-type: text/plain
cross-origin-resource-policy: cross-origin
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
access-control-allow-credentials: true
access-control-allow-origin: https://lp.constantcontactpages.com
x-served-by: cache-ams21026-AMS
POST

https://bam.nr-data.net/events/1/5ab79a9e36?a=5888164&v=1.246.1&to=Y1MHYRBUCBJZBRJfW1oZNkUQXAgGewkIQkZbWglQEBoFFBcdE0RYfVIAWxZcAAhdFBsWHHNzMRw%3D&rst=1862&ck=0&s=584eed1b9b3ace99&ref=https://lp.constantcontactpages.com/cu/dmXOzj7

chrome.exe

Remote address:

162.247.243.29:443

Request

POST /events/1/5ab79a9e36?a=5888164&v=1.246.1&to=Y1MHYRBUCBJZBRJfW1oZNkUQXAgGewkIQkZbWglQEBoFFBcdE0RYfVIAWxZcAAhdFBsWHHNzMRw%3D&rst=1862&ck=0&s=584eed1b9b3ace99&ref=https://lp.constantcontactpages.com/cu/dmXOzj7 HTTP/1.1
Host: bam.nr-data.net
Connection: keep-alive
Content-Length: 378
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-platform: "Windows"
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
content-type: text/plain
Accept: */*
Origin: https://lp.constantcontactpages.com
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://lp.constantcontactpages.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Connection: keep-alive
Content-Length: 24
date: Mon, 13 Nov 2023 15:38:28 GMT
content-type: image/gif
access-control-allow-origin: https://lp.constantcontactpages.com
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
access-control-allow-credentials: true
x-served-by: cache-ams21026-AMS
POST

https://bam.nr-data.net/jserrors/1/5ab79a9e36?a=5888164&v=1.246.1&to=Y1MHYRBUCBJZBRJfW1oZNkUQXAgGewkIQkZbWglQEBoFFBcdE0RYfVIAWxZcAAhdFBsWHHNzMRw%3D&rst=7035&ck=0&s=584eed1b9b3ace99&ref=https://lp.constantcontactpages.com/cu/dmXOzj7

chrome.exe

Remote address:

162.247.243.29:443

Request

POST /jserrors/1/5ab79a9e36?a=5888164&v=1.246.1&to=Y1MHYRBUCBJZBRJfW1oZNkUQXAgGewkIQkZbWglQEBoFFBcdE0RYfVIAWxZcAAhdFBsWHHNzMRw%3D&rst=7035&ck=0&s=584eed1b9b3ace99&ref=https://lp.constantcontactpages.com/cu/dmXOzj7 HTTP/1.1
Host: bam.nr-data.net
Connection: keep-alive
Content-Length: 546
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-platform: "Windows"
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Accept: */*
Origin: https://lp.constantcontactpages.com
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: no-cors
Sec-Fetch-Dest: empty
Referer: https://lp.constantcontactpages.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Connection: keep-alive
Content-Length: 24
date: Mon, 13 Nov 2023 15:38:34 GMT
content-type: image/gif
cross-origin-resource-policy: cross-origin
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
access-control-allow-credentials: true
access-control-allow-origin: https://lp.constantcontactpages.com
x-served-by: cache-ams21026-AMS
DNS

29.243.247.162.in-addr.arpa

Remote address:

8.8.8.8:53

Request

29.243.247.162.in-addr.arpa

IN PTR

Response
DNS

155.245.36.23.in-addr.arpa

Remote address:

8.8.8.8:53

Request

155.245.36.23.in-addr.arpa

IN PTR

Response

155.245.36.23.in-addr.arpa

IN PTR

a23-36-245-155deploystaticakamaitechnologiescom
POST

https://bam.nr-data.net/events/1/5ab79a9e36?a=5888164&v=1.246.1&to=Y1MHYRBUCBJZBRJfW1oZNkUQXAgGewkIQkZbWglQEBoFFBcdE0RYfVIAWxZcAAhdFBsWHHNzMRw%3D&rst=7041&ck=0&s=584eed1b9b3ace99&ref=https://lp.constantcontactpages.com/cu/dmXOzj7

chrome.exe

Remote address:

162.247.243.29:443

Request

POST /events/1/5ab79a9e36?a=5888164&v=1.246.1&to=Y1MHYRBUCBJZBRJfW1oZNkUQXAgGewkIQkZbWglQEBoFFBcdE0RYfVIAWxZcAAhdFBsWHHNzMRw%3D&rst=7041&ck=0&s=584eed1b9b3ace99&ref=https://lp.constantcontactpages.com/cu/dmXOzj7 HTTP/1.1
Host: bam.nr-data.net
Connection: keep-alive
Content-Length: 399
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-platform: "Windows"
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Accept: */*
Origin: https://lp.constantcontactpages.com
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: no-cors
Sec-Fetch-Dest: empty
Referer: https://lp.constantcontactpages.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Connection: close
Content-Length: 24
date: Mon, 13 Nov 2023 15:38:34 GMT
content-type: image/gif
cross-origin-resource-policy: cross-origin
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
access-control-allow-credentials: true
access-control-allow-origin: https://lp.constantcontactpages.com
x-served-by: cache-ams21061-AMS
POST

https://bam.nr-data.net/jserrors/1/5ab79a9e36?a=5888164&v=1.246.1&to=Y1MHYRBUCBJZBRJfW1oZNkUQXAgGewkIQkZbWglQEBoFFBcdE0RYfVIAWxZcAAhdFBsWHHNzMRw%3D&rst=7044&ck=0&s=584eed1b9b3ace99&ref=https://lp.constantcontactpages.com/cu/dmXOzj7

chrome.exe

Remote address:

162.247.243.29:443

Request

POST /jserrors/1/5ab79a9e36?a=5888164&v=1.246.1&to=Y1MHYRBUCBJZBRJfW1oZNkUQXAgGewkIQkZbWglQEBoFFBcdE0RYfVIAWxZcAAhdFBsWHHNzMRw%3D&rst=7044&ck=0&s=584eed1b9b3ace99&ref=https://lp.constantcontactpages.com/cu/dmXOzj7 HTTP/1.1
Host: bam.nr-data.net
Connection: keep-alive
Content-Length: 641
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-platform: "Windows"
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Accept: */*
Origin: https://lp.constantcontactpages.com
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: no-cors
Sec-Fetch-Dest: empty
Referer: https://lp.constantcontactpages.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Connection: keep-alive
Content-Length: 24
date: Mon, 13 Nov 2023 15:38:34 GMT
content-type: image/gif
cross-origin-resource-policy: cross-origin
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
access-control-allow-credentials: true
access-control-allow-origin: https://lp.constantcontactpages.com
x-served-by: cache-ams21081-AMS
DNS

146.78.124.51.in-addr.arpa

Remote address:

8.8.8.8:53

Request

146.78.124.51.in-addr.arpa

IN PTR

Response
DNS

157.123.68.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

157.123.68.40.in-addr.arpa

IN PTR

Response
DNS

171.39.242.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

171.39.242.20.in-addr.arpa

IN PTR

Response
DNS

58.252.72.23.in-addr.arpa

Remote address:

8.8.8.8:53

Request

58.252.72.23.in-addr.arpa

IN PTR

Response

58.252.72.23.in-addr.arpa

IN PTR

a23-72-252-58deploystaticakamaitechnologiescom
DNS

254.23.238.8.in-addr.arpa

Remote address:

8.8.8.8:53

Request

254.23.238.8.in-addr.arpa

IN PTR

Response
DNS

88.156.103.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

88.156.103.20.in-addr.arpa

IN PTR

Response
DNS

tse1.mm.bing.net

Remote address:

8.8.8.8:53

Request

tse1.mm.bing.net

IN A

Response

tse1.mm.bing.net

IN CNAME

mm-mm.bing.net.trafficmanager.net

mm-mm.bing.net.trafficmanager.net

IN CNAME

dual-a-0001.a-msedge.net

dual-a-0001.a-msedge.net

IN A

204.79.197.200

dual-a-0001.a-msedge.net

IN A

13.107.21.200
GET

https://tse1.mm.bing.net/th?id=OADD2.10239317301145_1Y8CXK45BT2OHNQQQ&pid=21.2&w=1920&h=1080&c=4

Remote address:

204.79.197.200:443

Request

GET /th?id=OADD2.10239317301145_1Y8CXK45BT2OHNQQQ&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 262756
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 386DF728724A476F8CCAD7FA45BB7BD9 Ref B: AMS04EDGE1311 Ref C: 2023-11-13T15:40:13Z
date: Mon, 13 Nov 2023 15:40:13 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239317301210_1O6WSVG17Q8FD2GN3&pid=21.2&w=1920&h=1080&c=4

Remote address:

204.79.197.200:443

Request

GET /th?id=OADD2.10239317301210_1O6WSVG17Q8FD2GN3&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 300661
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 2C103960837549958B0B5753A9759F7D Ref B: AMS04EDGE1311 Ref C: 2023-11-13T15:40:13Z
date: Mon, 13 Nov 2023 15:40:13 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239317301554_133DWC45UAH2W18HX&pid=21.2&w=1080&h=1920&c=4

Remote address:

204.79.197.200:443

Request

GET /th?id=OADD2.10239317301554_133DWC45UAH2W18HX&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 233894
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: C0F1365C2D894D8199A5961F0FC4B766 Ref B: AMS04EDGE1311 Ref C: 2023-11-13T15:40:13Z
date: Mon, 13 Nov 2023 15:40:13 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239317301531_15OFHFPSS82F0356I&pid=21.2&w=1080&h=1920&c=4

Remote address:

204.79.197.200:443

Request

GET /th?id=OADD2.10239317301531_15OFHFPSS82F0356I&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 127317
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 39BDBBFA3BFC4EB49F92FBF50F27AA5D Ref B: AMS04EDGE1311 Ref C: 2023-11-13T15:40:13Z
date: Mon, 13 Nov 2023 15:40:13 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239317301098_1PK7071OS7E5PB0P3&pid=21.2&w=1920&h=1080&c=4

Remote address:

204.79.197.200:443

Request

GET /th?id=OADD2.10239317301098_1PK7071OS7E5PB0P3&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 143173
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 2EDAA567754647BFBB6C677119B97105 Ref B: AMS04EDGE1311 Ref C: 2023-11-13T15:40:13Z
date: Mon, 13 Nov 2023 15:40:13 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239317301619_1XBK40W4REDBFTJ48&pid=21.2&w=1080&h=1920&c=4

Remote address:

204.79.197.200:443

Request

GET /th?id=OADD2.10239317301619_1XBK40W4REDBFTJ48&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 201688
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 2FB1698093FA40B6887873324D0F3551 Ref B: AMS04EDGE1311 Ref C: 2023-11-13T15:40:14Z
date: Mon, 13 Nov 2023 15:40:14 GMT
DNS

121.150.79.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

121.150.79.40.in-addr.arpa

IN PTR

Response

172.64.149.60:443

lp.constantcontactpages.com

tls

chrome.exe

4.0kB
26.4kB
42
50
172.64.147.103:443

https://static.ctctcdn.com/ui/images1/favicon/favicon.png?rb=2

tls, http2

chrome.exe

2.0kB
8.9kB
18
21

HTTP Request

GET https://static.ctctcdn.com/ui/images1/landing_page_block_icon_error_crop.svg

HTTP Response

200

HTTP Request

GET https://static.ctctcdn.com/ui/images1/favicon/favicon.png?rb=2

HTTP Response

200
151.101.2.137:443

https://js-agent.newrelic.com/nr-spa-1.246.1.min.js

tls, http2

chrome.exe

2.2kB
36.7kB
24
37

HTTP Request

GET https://js-agent.newrelic.com/nr-spa-1.246.1.min.js

HTTP Response

200
162.247.243.29:443

https://bam.nr-data.net/jserrors/1/5ab79a9e36?a=5888164&v=1.246.1&to=Y1MHYRBUCBJZBRJfW1oZNkUQXAgGewkIQkZbWglQEBoFFBcdE0RYfVIAWxZcAAhdFBsWHHNzMRw%3D&rst=7035&ck=0&s=584eed1b9b3ace99&ref=https://lp.constantcontactpages.com/cu/dmXOzj7

tls, http

chrome.exe

6.7kB
7.1kB
17
18

HTTP Request

POST https://bam.nr-data.net/1/5ab79a9e36?a=5888164&v=1.246.1&to=Y1MHYRBUCBJZBRJfW1oZNkUQXAgGewkIQkZbWglQEBoFFBcdE0RYfVIAWxZcAAhdFBsWHHNzMRw%3D&rst=1555&ck=0&s=584eed1b9b3ace99&ref=https://lp.constantcontactpages.com/cu/dmXOzj7&af=err,xhr,stn,ins,spa&ap=128&be=654&fe=333&dc=118&at=TxQQF1hORCJZCxZXXVNYLFFAD0RQAVMABANVBUgMVgZfTAxXVgQZDARVAk8DVgBbUQUGVlJSUwJAGUQgWxIPQF1ATyxRQA9EUwtTAAJWUlNIVgcNBEwMXgVXGQ1VUA1PV1JTWV5SD1EMDwFUQBlEMlESA3lDWlMXfAYXXFAJUlYOBQUOXQVTAlAcRQ%3D%3D&fsh=1&perf=%7B%22timing%22:%7B%22of%22:1699889905789,%22n%22:0,%22f%22:38,%22dn%22:226,%22dne%22:299,%22c%22:299,%22s%22:332,%22ce%22:392,%22rq%22:393,%22rp%22:654,%22rpe%22:735,%22di%22:772,%22ds%22:772,%22de%22:772,%22dc%22:946,%22l%22:946,%22le%22:987%7D,%22navigation%22:%7B%7D%7D&fp=771&fcp=771

HTTP Response

200

HTTP Request

POST https://bam.nr-data.net/events/1/5ab79a9e36?a=5888164&v=1.246.1&to=Y1MHYRBUCBJZBRJfW1oZNkUQXAgGewkIQkZbWglQEBoFFBcdE0RYfVIAWxZcAAhdFBsWHHNzMRw%3D&rst=1862&ck=0&s=584eed1b9b3ace99&ref=https://lp.constantcontactpages.com/cu/dmXOzj7

HTTP Response

200

HTTP Request

POST https://bam.nr-data.net/jserrors/1/5ab79a9e36?a=5888164&v=1.246.1&to=Y1MHYRBUCBJZBRJfW1oZNkUQXAgGewkIQkZbWglQEBoFFBcdE0RYfVIAWxZcAAhdFBsWHHNzMRw%3D&rst=7035&ck=0&s=584eed1b9b3ace99&ref=https://lp.constantcontactpages.com/cu/dmXOzj7

HTTP Response

200
162.247.243.29:443

https://bam.nr-data.net/events/1/5ab79a9e36?a=5888164&v=1.246.1&to=Y1MHYRBUCBJZBRJfW1oZNkUQXAgGewkIQkZbWglQEBoFFBcdE0RYfVIAWxZcAAhdFBsWHHNzMRw%3D&rst=7041&ck=0&s=584eed1b9b3ace99&ref=https://lp.constantcontactpages.com/cu/dmXOzj7

tls, http

chrome.exe

2.2kB
1.2kB
7
8

HTTP Request

POST https://bam.nr-data.net/events/1/5ab79a9e36?a=5888164&v=1.246.1&to=Y1MHYRBUCBJZBRJfW1oZNkUQXAgGewkIQkZbWglQEBoFFBcdE0RYfVIAWxZcAAhdFBsWHHNzMRw%3D&rst=7041&ck=0&s=584eed1b9b3ace99&ref=https://lp.constantcontactpages.com/cu/dmXOzj7

HTTP Response

200
162.247.243.29:443

https://bam.nr-data.net/jserrors/1/5ab79a9e36?a=5888164&v=1.246.1&to=Y1MHYRBUCBJZBRJfW1oZNkUQXAgGewkIQkZbWglQEBoFFBcdE0RYfVIAWxZcAAhdFBsWHHNzMRw%3D&rst=7044&ck=0&s=584eed1b9b3ace99&ref=https://lp.constantcontactpages.com/cu/dmXOzj7

tls, http

chrome.exe

2.6kB
5.7kB
12
13

HTTP Request

POST https://bam.nr-data.net/jserrors/1/5ab79a9e36?a=5888164&v=1.246.1&to=Y1MHYRBUCBJZBRJfW1oZNkUQXAgGewkIQkZbWglQEBoFFBcdE0RYfVIAWxZcAAhdFBsWHHNzMRw%3D&rst=7044&ck=0&s=584eed1b9b3ace99&ref=https://lp.constantcontactpages.com/cu/dmXOzj7

HTTP Response

200
204.79.197.200:443

tse1.mm.bing.net

tls, http2

1.2kB
8.3kB
16
14
204.79.197.200:443

tse1.mm.bing.net

tls, http2

1.2kB
8.3kB
16
14
204.79.197.200:443

tse1.mm.bing.net

tls, http2

1.2kB
8.3kB
16
14
204.79.197.200:443

tse1.mm.bing.net

tls, http2

1.2kB
8.3kB
16
14
204.79.197.200:443

https://tse1.mm.bing.net/th?id=OADD2.10239317301619_1XBK40W4REDBFTJ48&pid=21.2&w=1080&h=1920&c=4

tls, http2

47.2kB
1.3MB
972
968

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239317301145_1Y8CXK45BT2OHNQQQ&pid=21.2&w=1920&h=1080&c=4

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239317301210_1O6WSVG17Q8FD2GN3&pid=21.2&w=1920&h=1080&c=4

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239317301554_133DWC45UAH2W18HX&pid=21.2&w=1080&h=1920&c=4

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239317301531_15OFHFPSS82F0356I&pid=21.2&w=1080&h=1920&c=4

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239317301098_1PK7071OS7E5PB0P3&pid=21.2&w=1920&h=1080&c=4

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239317301619_1XBK40W4REDBFTJ48&pid=21.2&w=1080&h=1920&c=4

HTTP Response

200

8.8.8.8:53

lp.constantcontactpages.com

dns

chrome.exe

73 B
165 B
1
1

DNS Request

lp.constantcontactpages.com

DNS Response

172.64.149.60

104.18.38.196
8.8.8.8:53

73.159.190.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

73.159.190.20.in-addr.arpa
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

95.221.229.192.in-addr.arpa
8.8.8.8:53

158.240.127.40.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

158.240.127.40.in-addr.arpa
8.8.8.8:53

234.168.217.172.in-addr.arpa

dns

74 B
113 B
1
1

DNS Request

234.168.217.172.in-addr.arpa
8.8.8.8:53

9.228.82.20.in-addr.arpa

dns

70 B
156 B
1
1

DNS Request

9.228.82.20.in-addr.arpa
8.8.8.8:53

60.149.64.172.in-addr.arpa

dns

72 B
134 B
1
1

DNS Request

60.149.64.172.in-addr.arpa
8.8.8.8:53

static.ctctcdn.com

dns

chrome.exe

64 B
147 B
1
1

DNS Request

static.ctctcdn.com

DNS Response

172.64.147.103

104.18.40.153
8.8.8.8:53

js-agent.newrelic.com

dns

chrome.exe

67 B
168 B
1
1

DNS Request

js-agent.newrelic.com

DNS Response

151.101.2.137

151.101.66.137

151.101.130.137

151.101.194.137
8.8.8.8:53

103.147.64.172.in-addr.arpa

dns

73 B
135 B
1
1

DNS Request

103.147.64.172.in-addr.arpa
8.8.8.8:53

bam.nr-data.net

dns

chrome.exe

61 B
131 B
1
1

DNS Request

bam.nr-data.net

DNS Response

162.247.243.29
8.8.8.8:53

137.2.101.151.in-addr.arpa

dns

72 B
132 B
1
1

DNS Request

137.2.101.151.in-addr.arpa
8.8.8.8:53

226.21.18.104.in-addr.arpa

dns

72 B
134 B
1
1

DNS Request

226.21.18.104.in-addr.arpa
8.8.8.8:53

29.243.247.162.in-addr.arpa

dns

73 B
138 B
1
1

DNS Request

29.243.247.162.in-addr.arpa
8.8.8.8:53

155.245.36.23.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

155.245.36.23.in-addr.arpa
224.0.0.251:5353

chrome.exe

204 B
3
8.8.8.8:53

146.78.124.51.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

146.78.124.51.in-addr.arpa
8.8.8.8:53

157.123.68.40.in-addr.arpa

dns

72 B
146 B
1
1

DNS Request

157.123.68.40.in-addr.arpa
8.8.8.8:53

171.39.242.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

171.39.242.20.in-addr.arpa
8.8.8.8:53

58.252.72.23.in-addr.arpa

dns

71 B
135 B
1
1

DNS Request

58.252.72.23.in-addr.arpa
8.8.8.8:53

254.23.238.8.in-addr.arpa

dns

71 B
125 B
1
1

DNS Request

254.23.238.8.in-addr.arpa
8.8.8.8:53

88.156.103.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

88.156.103.20.in-addr.arpa
8.8.8.8:53

tse1.mm.bing.net

dns

62 B
173 B
1
1

DNS Request

tse1.mm.bing.net

DNS Response

204.79.197.200

13.107.21.200
8.8.8.8:53

121.150.79.40.in-addr.arpa

dns

72 B
146 B
1
1

DNS Request

121.150.79.40.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
a10ebc7d77cb3cf6998c0ba2f39ebf4d

SHA1
a5e232819da59305903577afbf71f839cfc1a5fa

SHA256
a956e0c9ce674794d55d1fa39c4c74060e3b5644add7e9dcc7ba1fb39d501432

SHA512
1fa38b7baf6e1fe55974f2b146fd88c9c925ec97f07efa29e0c150447b0398e462e4d3e9a51229922039572f6a9340f546da7f67805886e9a0961f93c5684cc0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
bcf790a02719c035a25bb983431439c0

SHA1
2fbaf8ca2b2109f64f8139dcfc07d2e464650a52

SHA256
38d971ab652f75e91b31ff5865b19fa6d93707fbf463b0e4fc3980093fc04e34

SHA512
b8a42f56cec303ad685d00e33ed58514fec7ffbe4f69a67b70074a2e40176bc8513dd08f62c799c468c84b0e8f71af334669cbb0ccef2d892d51fda97a087e07

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
537B

MD5
284a46b8133d0f53fbbc43ea9608755a

SHA1
d090fdd1d6b9b281ed9fcff23699c409d2936770

SHA256
3bed13d781e3fe1c15a87a554fc28f33136de9a2d18ecd63034d3077736356da

SHA512
e19b8376194519b4ee6aaa29ec11909b4144401ed2c1d740a4363ad8f38e89ad88bd4bf670ae22f3d388474d8a7d059be48e21077319cb979eaad89b88eacfc3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
182e8f9264ffbbbc319e8dbddcd398b6

SHA1
e45c232ebfc78b955040a4fcc0b0142bb08f3423

SHA256
c762f1ee45b706dc86dc2376afa26fd2b5a0123e5b40f873cf9115a1a2ff92b8

SHA512
c6b26ece42394f6d625a9274d2035069d3e35050928cbf65f935a368a5ead980d7e60b031c6f162567bbdc1d22317187ae0415804404c6614e840a7f27ac9c4f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
df44449276d9a393215b8e9011d290a5

SHA1
c14fa4d5a78e0c9695e49d4821b69cded8cd9712

SHA256
406461724021e366704b2a97250bb540d5339f84c517123772ad1fff2e7d0deb

SHA512
005ecc8518992ed07fdd104ec75d6294eae4fc31257d21d62219a137474a8d06a940d35316c44cbdcbe69d46279f61d67fc9031fbc88e136329e2d1290da9f5d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
109KB

MD5
cbb7e5e6e167d10a8cbf17738bc6827c

SHA1
e3fa6594962f79717cc7bf8e19d87fca23f80650

SHA256
29ff540fa9bfded559d7994fbc97fe8e4bcc15f878eda7f6229416ca41a0c2fb

SHA512
9c2afe124c8056d07bbb138dd1ceb36ff7c02cc263f967aea6e0582468ddc31de501446ba14ecbe8eeeb0632a8e6832ef09c72230d3ce6c4d393f7d8b31571b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b6948e3c-e941-4696-be34-8883d85679cc.tmp

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.